You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Stephane Passignat <pa...@hotmail.com> on 2022/06/22 09:18:27 UTC
CVE-2022-29885
Hello,
I'm trying to understand this CVE and EncryptInterceptor.
So far my understanding is EncryptInterceptor is used in clustered
environment. Am I right ?
Reading the content of the commit and release content, that's only look
like a documentation issue. Are there really any DDOS weakness ?
thanks,
Stephane
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: CVE-2022-29885
Posted by Stephane Passignat <pa...@hotmail.com>.
thank you Mark
Le 2022-06-22 à 11:52, Mark Thomas a écrit :
> On 22/06/2022 10:18, Stephane Passignat wrote:
>> Hello,
>>
>> I'm trying to understand this CVE and EncryptInterceptor.
>>
>> So far my understanding is EncryptInterceptor is used in clustered
>> environment. Am I right ?
>>
>> Reading the content of the commit and release content, that's only
>> look like a documentation issue. Are there really any DDOS weakness ?
>
> Yes, there is a DoS issue. If you use the EncryptInterceptor on an
> untrusted network then it is possible for an attacker to mount a DoS
> attack on the Tomcat instances in the network.
>
> The documentation change was to make clear that it wasn't safe to do
> this.
>
> If we implement message size limits for cluster messages then an
> appropriate message limit along with the EncryptInterceptor should be
> safe (but I can't be certain as we haven't implemented and tested it).
>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: CVE-2022-29885
Posted by Mark Thomas <ma...@apache.org>.
On 22/06/2022 10:18, Stephane Passignat wrote:
> Hello,
>
> I'm trying to understand this CVE and EncryptInterceptor.
>
> So far my understanding is EncryptInterceptor is used in clustered
> environment. Am I right ?
>
> Reading the content of the commit and release content, that's only look
> like a documentation issue. Are there really any DDOS weakness ?
Yes, there is a DoS issue. If you use the EncryptInterceptor on an
untrusted network then it is possible for an attacker to mount a DoS
attack on the Tomcat instances in the network.
The documentation change was to make clear that it wasn't safe to do this.
If we implement message size limits for cluster messages then an
appropriate message limit along with the EncryptInterceptor should be
safe (but I can't be certain as we haven't implemented and tested it).
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org